bluebar.php doesn't enforce in-proxy association

[root]

* This page doesn't include check_user.php and doesn't do its own in-proxy association check (that the user is coming from the proxy they are limited to)
            * It's not trivial to exploit this with just a web browser, as you'd have to move your cookie from one domain to another.

[Adam P (adam+)]

If the fix for Bug #552603 results in the removal of enforced proxy associations, this bug will go away.

[e.fryntov (e-fryntov)]

I think the whole 'include check_user.php' idea is obsolete.

There's no reason to either let user through or show login form for every php script anymore.

The only page that shows login form is this: https://hostname/login_url.

All unauthenticated requests will be denied access by mod_psiphon_auth as it set globally on the server at the document root level like this:

<Location />
PsiphonAuthEnable On
....
</Location>

There's no need to do any user authentication checking in php scripts anymore except for those that listed in the 'PsiphonNoAuth' directive.

[e.fryntov (e-fryntov)]

I'm going to go ahead and mark this bug as 'invalid'